Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-09-2024 17:57

General

  • Target

    7ec234d569603660080ea0d4a7e4e54e237e519089dddca4c678038cbadcc778.exe

  • Size

    1.8MB

  • MD5

    17501ef864154a07ad62b3b54e0fc9ce

  • SHA1

    478c0b532235f76c9036627fdc9286a1e570af92

  • SHA256

    7ec234d569603660080ea0d4a7e4e54e237e519089dddca4c678038cbadcc778

  • SHA512

    ed7bdd54e7046de070f348503989518b3517abc391423bd8d161ac305fec2eedd03977e212a5ffe13648fb615ace191b7edba3c3f386ad6552ff050f6c182cd8

  • SSDEEP

    24576:1VilaMfuzphJnD5g5ymevG2GF8AkoWho2lY5P4+WjePCy8/URLujliYfnUKsqbKw:bSaMapTnbmmekFKAZn1sR6EwUKPKM

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

c7817d

C2

http://31.41.244.10

Attributes
  • install_dir

    0e8d0864aa

  • install_file

    svoutse.exe

  • strings_key

    5481b88a6ef75bcf21333988a4e47048

  • url_paths

    /Dem7kTu/index.php

rc4.plain

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 10 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Identifies Wine through registry keys 2 TTPs 5 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 14 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 25 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 46 IoCs
  • Suspicious use of SendNotifyMessage 44 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\7ec234d569603660080ea0d4a7e4e54e237e519089dddca4c678038cbadcc778.exe
    "C:\Users\Admin\AppData\Local\Temp\7ec234d569603660080ea0d4a7e4e54e237e519089dddca4c678038cbadcc778.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3976
    • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
      "C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1460
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\Admin\AppData\Local\Temp\1000039041\do.ps1"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2744
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /c start msedge https://www.youtube.com/account
          4⤵
          • Checks computer location settings
          • System Location Discovery: System Language Discovery
          PID:3652
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.youtube.com/account
            5⤵
            • Enumerates system info in registry
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            PID:2680
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd011146f8,0x7ffd01114708,0x7ffd01114718
              6⤵
                PID:4776
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,3852768388798091144,357844033713910031,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
                6⤵
                  PID:3804
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,3852768388798091144,357844033713910031,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
                  6⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:2720
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,3852768388798091144,357844033713910031,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2676 /prefetch:8
                  6⤵
                    PID:5040
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,3852768388798091144,357844033713910031,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
                    6⤵
                      PID:3596
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,3852768388798091144,357844033713910031,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
                      6⤵
                        PID:1956
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,3852768388798091144,357844033713910031,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1468 /prefetch:1
                        6⤵
                          PID:5208
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,3852768388798091144,357844033713910031,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:1
                          6⤵
                            PID:5588
                          • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,3852768388798091144,357844033713910031,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5928 /prefetch:8
                            6⤵
                              PID:1100
                            • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,3852768388798091144,357844033713910031,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5928 /prefetch:8
                              6⤵
                              • Suspicious behavior: EnumeratesProcesses
                              PID:6052
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,3852768388798091144,357844033713910031,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:1
                              6⤵
                                PID:1140
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,3852768388798091144,357844033713910031,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:1
                                6⤵
                                  PID:5456
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,3852768388798091144,357844033713910031,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4280 /prefetch:1
                                  6⤵
                                    PID:5664
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,3852768388798091144,357844033713910031,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:1
                                    6⤵
                                      PID:5628
                                • C:\Windows\SysWOW64\cmd.exe
                                  "C:\Windows\system32\cmd.exe" /c start msedge https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
                                  4⤵
                                  • Checks computer location settings
                                  • System Location Discovery: System Language Discovery
                                  PID:3508
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://accounts.google.com/ServiceLogin?service=accountsettings
                                    5⤵
                                      PID:1512
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffd011146f8,0x7ffd01114708,0x7ffd01114718
                                        6⤵
                                          PID:376
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,26049835834727229,4416666535191684659,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
                                          6⤵
                                          • Suspicious behavior: EnumeratesProcesses
                                          PID:5160
                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                      "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
                                      4⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:3492
                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                        "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
                                        5⤵
                                        • Checks processor information in registry
                                        PID:2244
                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                      "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
                                      4⤵
                                      • Checks processor information in registry
                                      • Modifies registry class
                                      • Suspicious use of FindShellTrayWindow
                                      • Suspicious use of SendNotifyMessage
                                      • Suspicious use of SetWindowsHookEx
                                      • Suspicious use of WriteProcessMemory
                                      PID:2768
                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1920 -parentBuildID 20240401114208 -prefsHandle 1848 -prefMapHandle 1840 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {adb42150-171e-4ae3-92ca-8c9ecef32e0c} 2768 "\\.\pipe\gecko-crash-server-pipe.2768" gpu
                                        5⤵
                                          PID:2288
                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2412 -parentBuildID 20240401114208 -prefsHandle 2388 -prefMapHandle 2380 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e9fa75d4-b168-4abc-acb4-ce3c36cc8f45} 2768 "\\.\pipe\gecko-crash-server-pipe.2768" socket
                                          5⤵
                                            PID:2916
                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3168 -childID 1 -isForBrowser -prefsHandle 3084 -prefMapHandle 3080 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1152 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5b89ee32-d366-404f-8945-2689ebea550c} 2768 "\\.\pipe\gecko-crash-server-pipe.2768" tab
                                            5⤵
                                              PID:640
                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3604 -childID 2 -isForBrowser -prefsHandle 3600 -prefMapHandle 3592 -prefsLen 22693 -prefMapSize 244658 -jsInitHandle 1152 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {579e6ed9-cccb-4d24-811a-79febf974857} 2768 "\\.\pipe\gecko-crash-server-pipe.2768" tab
                                              5⤵
                                                PID:3968
                                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4092 -childID 3 -isForBrowser -prefsHandle 4084 -prefMapHandle 4080 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1152 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2260201f-6be3-4267-8ed3-86b9b9e25c49} 2768 "\\.\pipe\gecko-crash-server-pipe.2768" tab
                                                5⤵
                                                  PID:1852
                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4484 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4724 -prefMapHandle 4488 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {dc7d9fdf-a7f4-477a-805b-44d6a7c8e821} 2768 "\\.\pipe\gecko-crash-server-pipe.2768" utility
                                                  5⤵
                                                  • Checks processor information in registry
                                                  PID:2732
                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5816 -childID 4 -isForBrowser -prefsHandle 5804 -prefMapHandle 5480 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1152 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {48347611-c602-48d9-bce3-a0b6ee0030fc} 2768 "\\.\pipe\gecko-crash-server-pipe.2768" tab
                                                  5⤵
                                                    PID:5960
                                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5952 -childID 5 -isForBrowser -prefsHandle 5960 -prefMapHandle 5964 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1152 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {19face80-7cf4-47f1-810b-59be25a407dc} 2768 "\\.\pipe\gecko-crash-server-pipe.2768" tab
                                                    5⤵
                                                      PID:5972
                                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6136 -childID 6 -isForBrowser -prefsHandle 6148 -prefMapHandle 6152 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1152 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {947ddb04-f594-498f-ae03-577ad2a6f371} 2768 "\\.\pipe\gecko-crash-server-pipe.2768" tab
                                                      5⤵
                                                        PID:5984
                                              • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                                                C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                                                1⤵
                                                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                • Checks BIOS information in registry
                                                • Executes dropped EXE
                                                • Identifies Wine through registry keys
                                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                • Suspicious behavior: EnumeratesProcesses
                                                PID:1440
                                              • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                                                C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                                                1⤵
                                                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                • Checks BIOS information in registry
                                                • Executes dropped EXE
                                                • Identifies Wine through registry keys
                                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                • Suspicious behavior: EnumeratesProcesses
                                                PID:2064
                                              • C:\Windows\System32\CompPkgSrv.exe
                                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                1⤵
                                                  PID:2408
                                                • C:\Windows\System32\CompPkgSrv.exe
                                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                  1⤵
                                                    PID:5432
                                                  • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                                                    C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                                                    1⤵
                                                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                    • Checks BIOS information in registry
                                                    • Executes dropped EXE
                                                    • Identifies Wine through registry keys
                                                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    PID:5436

                                                  Network

                                                  MITRE ATT&CK Enterprise v15

                                                  Replay Monitor

                                                  Loading Replay Monitor...

                                                  Downloads

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                    Filesize

                                                    152B

                                                    MD5

                                                    2dc1a9f2f3f8c3cfe51bb29b078166c5

                                                    SHA1

                                                    eaf3c3dad3c8dc6f18dc3e055b415da78b704402

                                                    SHA256

                                                    dcb76fa365c2d9ee213b224a91cdd806d30b1e8652d72a22f2371124fa4479fa

                                                    SHA512

                                                    682061d9cc86a6e5d99d022da776fb554350fc95efbf29cd84c1db4e2b7161b76cd1de48335bcc3a25633079fb0bd412e4f4795ed6291c65e9bc28d95330bb25

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                    Filesize

                                                    152B

                                                    MD5

                                                    e4f80e7950cbd3bb11257d2000cb885e

                                                    SHA1

                                                    10ac643904d539042d8f7aa4a312b13ec2106035

                                                    SHA256

                                                    1184ee8d32d0edecddd93403fb888fad6b3e2a710d37335c3989cc529bc08124

                                                    SHA512

                                                    2b92c9807fdcd937e514d4e7e1cc7c2d3e3aa162099b7289ceac2feea72d1a4afbadf1c09b3075d470efadf9a9edd63e07ea7e7a98d22243e45b3d53473fa4f0

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                    Filesize

                                                    5KB

                                                    MD5

                                                    5f31d4698926a5bdf65c1fc1dfb805a6

                                                    SHA1

                                                    0b8c6686c83ad55c336c074acb43be51e7587415

                                                    SHA256

                                                    18d0ee5ca470b2696d64eb916a49caee88cbf1fbe8efa8dd808e430f0403b8d3

                                                    SHA512

                                                    a0f45c1221d4ea09a45b2aaf0d2b273686f7e4f47afd6074501a82eca3733c4dda4976a57c4fdd9ffe42b1b98ad565bdcd61864d230ad5ea2dc1adda8a1ea787

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                    Filesize

                                                    7KB

                                                    MD5

                                                    09e67e7984afb1a265fbf1c163f2ce38

                                                    SHA1

                                                    c632765d4352e0dbc3a6a6d75b2898cf3f36531c

                                                    SHA256

                                                    c6a2d4f6409696c3e5b237665b71bfa83676fa6e05d29edf47772a0482e5aa7f

                                                    SHA512

                                                    7dd8c7b54a7bac56642804e40d5e732d56d6d75d8ee5a8495178d4b0117ff5293fe20a2fe7beed526fdd6860298d298d4b0800e0b0a6e1a75ee9199a1c44e18d

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                    Filesize

                                                    16B

                                                    MD5

                                                    6752a1d65b201c13b62ea44016eb221f

                                                    SHA1

                                                    58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                    SHA256

                                                    0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                    SHA512

                                                    9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                    Filesize

                                                    10KB

                                                    MD5

                                                    96a43409ebbe577292fcf44460d7477f

                                                    SHA1

                                                    5d7bb8b35dc546cfa11db69d0a33085734b7bcf8

                                                    SHA256

                                                    c57fe32a464ca8a12191c255a16b0b94cd8747c7391ddb0a5318d3e9d96ed6f7

                                                    SHA512

                                                    90e635973e442b4f5fd6e1daa70e5bf1bc32bfd1a2772d1698805b585e3a584c6155d2dd4df5965d00a43bcc9169d283ad403e1efcfa0415aa69176dfb9f7182

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                    Filesize

                                                    8KB

                                                    MD5

                                                    51e48273d6489f01b59de95e2d68faa8

                                                    SHA1

                                                    2aa4773bf31176ba59f9dea0b78db70c6bdcf8fe

                                                    SHA256

                                                    5e169b93fd3ac4c9562eb70a2cc53ba7d7fa7997c70055b5c40ae73d2c8e9c7a

                                                    SHA512

                                                    d4c0cbc2a9350d85951c04f4a6c9fb42bcb17da565bf4e0fdb198e6a51e86a8e95f9fe0f926dde9d499005ea52d8d59d788af057b122049720e146eed4ff9479

                                                  • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe

                                                    Filesize

                                                    1.8MB

                                                    MD5

                                                    17501ef864154a07ad62b3b54e0fc9ce

                                                    SHA1

                                                    478c0b532235f76c9036627fdc9286a1e570af92

                                                    SHA256

                                                    7ec234d569603660080ea0d4a7e4e54e237e519089dddca4c678038cbadcc778

                                                    SHA512

                                                    ed7bdd54e7046de070f348503989518b3517abc391423bd8d161ac305fec2eedd03977e212a5ffe13648fb615ace191b7edba3c3f386ad6552ff050f6c182cd8

                                                  • C:\Users\Admin\AppData\Local\Temp\1000039041\do.ps1

                                                    Filesize

                                                    2KB

                                                    MD5

                                                    e05e8f072b373beafe27cc11d85f947c

                                                    SHA1

                                                    1d6daeb98893e8122b8b69287ebd9d43f3c6138e

                                                    SHA256

                                                    717c09427fa5754ba92f92961545534048d0a76528c2e95c4d5ec6cef47c612f

                                                    SHA512

                                                    b3e34162e5ee43bb01f289eebc45fd3ea3e07f30be40dcf6635606540f912fe5c84d301e9f78e97dfe3ffe53e72547e50f3bcd7d4ebe5ab8da451a1989c469a0

                                                  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4b0wqw0s.eby.ps1

                                                    Filesize

                                                    60B

                                                    MD5

                                                    d17fe0a3f47be24a6453e9ef58c94641

                                                    SHA1

                                                    6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                    SHA256

                                                    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                    SHA512

                                                    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                  • C:\Users\Admin\AppData\Roaming\1000026000\adfb77ef54.exe

                                                    Filesize

                                                    160KB

                                                    MD5

                                                    4f567d2e5330efba274e7f94646b7fc1

                                                    SHA1

                                                    bd620e2e7a10d97c0e9583387e16e27b029149a7

                                                    SHA256

                                                    bccf2697513010f1b46c245e93a4f58fb38e00285fe5b56c6962dfce6bd0b573

                                                    SHA512

                                                    058799d373304ab64455f1250738af9d71e44d72067a3eddc7adcb5df5e59d9a5f66d6341c00b3164c3a7bc1a06dc19476d5f83865712a17be7f2696f2994b42

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\AlternateServices.bin

                                                    Filesize

                                                    6KB

                                                    MD5

                                                    4ce9986b68cbeb39ad7636d851d5c98b

                                                    SHA1

                                                    90cf12052d02c852bd7546f163c42e8f7c96e831

                                                    SHA256

                                                    cef1a51ce1d6bbdbbc3ce317212cd1647d33077e2937704faed82377f2bf3ad9

                                                    SHA512

                                                    1658aa5789faf1498dab0691b56e05b655fc29a14f20c2a7b1b3ef6e9f57811f6c18dc2ba52da8c89ce66010dda96592571fa47bc206e1f01623a5f48180ca26

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\AlternateServices.bin

                                                    Filesize

                                                    12KB

                                                    MD5

                                                    898495991bbeaadeb663d30d9eb06c3b

                                                    SHA1

                                                    176ec70ccdd8d3b4dff4a106498e7024bde406f3

                                                    SHA256

                                                    637226b17a422f027bc38824b2c71a27365c98e93d52c12ebe33b86a11f450ff

                                                    SHA512

                                                    400fe97fae95f703a991234893eea774708fc6e20c59f016aaa866937254e2b5ec21e67fb15575542630cfae9faec6b54b5dbbf88431d28a55285fe59d526029

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\datareporting\glean\db\data.safe.tmp

                                                    Filesize

                                                    5KB

                                                    MD5

                                                    c2f9b3151ded64756d6f558b0a1379ce

                                                    SHA1

                                                    136a387f82a35d322ad3be02c500bafbbc57a439

                                                    SHA256

                                                    dc1fcbcc7e2176c1660d454eac2a1255bf0ab96b05ac2a16b32d2a97964192e0

                                                    SHA512

                                                    2c8644fca19f116a21cde5cf9662c33c2b451542dbb477c95ba713c50a3949c01ac88ca6a873b913fbaa30c1cac95714b0b47d21bfb0a924418ba1a4cc82a866

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\datareporting\glean\pending_pings\03264fe4-b11a-44fb-8539-8488124ada3c

                                                    Filesize

                                                    26KB

                                                    MD5

                                                    630bf0ef1158dea82bd4bef1d9aad6de

                                                    SHA1

                                                    c5adac373fa65b37a04d6a60f85ed7aedb1677fe

                                                    SHA256

                                                    c3d225c976ab96c7a856fb6772fb083f2f0a424a045570ee34319f8b86542777

                                                    SHA512

                                                    6a1d14d54b6d555615604d017061c138b5a136c65b88dffcaf3e6fb8fe10307fa0f848ac7c2f57094a3faf6b70bd4ab18483b79343deb95b69a7e5dd3d67cf3e

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\datareporting\glean\pending_pings\05fab160-cca0-49bd-84e7-bbdb98404b03

                                                    Filesize

                                                    982B

                                                    MD5

                                                    a5f20f9ca1ba54abc6d716b6c9563dc5

                                                    SHA1

                                                    9d7a938d5887e2e70a1e25ed0c7245b1c9e5bc5f

                                                    SHA256

                                                    9ed2e7b2ce7a169bcd1ba8a024e8a63624fbe7a3c7607bc40afe982255369f13

                                                    SHA512

                                                    c54f4dc6a33667611871fa4c78667ee4102592a155205c9853faed07bf9c5209873f798790a42ca17a31593d119fda0a6dfa4c879a69f949791a9e3920e1a58a

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\datareporting\glean\pending_pings\27f3b218-216c-4745-98d5-95f050aaee06

                                                    Filesize

                                                    671B

                                                    MD5

                                                    2ff016f5f8b7fb27ec40f161b4644f03

                                                    SHA1

                                                    abf4ac7f21b90d29b533a80bbecf12fbbfd0b47a

                                                    SHA256

                                                    664a2a986dc4283713ac6cd02ff45930a127188e32e26630e7a457ebbf963e91

                                                    SHA512

                                                    aa903cba83621e975d587adeb5bbe4fc543b61af1d356b10279aa43024c00b3868c736b4c747ae184c2fa18441876f9692bf49dc9a45436639a3d328c06445e5

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\prefs-1.js

                                                    Filesize

                                                    11KB

                                                    MD5

                                                    643032f4cf00be830ef61cabb43b2517

                                                    SHA1

                                                    c4af91cd866b622ab7887d1e36732071a23342a9

                                                    SHA256

                                                    515e94d66dfcd36a7efe3945111aebe2b4b7b83411afab37ae46d85833c93561

                                                    SHA512

                                                    58ce4df35c61666e419b1108b727f758dcf78594e843ed5f6a1d35a01513ac7013247417aa0541c2d0edad774dd01cd8c8b5d65cc0d9791cff2861be545dd6bf

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\prefs.js

                                                    Filesize

                                                    11KB

                                                    MD5

                                                    f7e03fdd1f5584bdbecb7556dbe75c10

                                                    SHA1

                                                    7923de230cc3c88d841d6e7ec3f8dc1accb9ca10

                                                    SHA256

                                                    ee5576ab6d060bb1604f37faf2c110ca4fc3259292b84be327e9fd84d36ae538

                                                    SHA512

                                                    2d634069b2736e2d88a194eee04b2202bf2fa04496bbf4927a12db203a6ffa19b32d77f84617845b9f0dba7090a6c07f62a28245982a436ecd6dbf295b1a27ba

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\sessionstore-backups\recovery.baklz4

                                                    Filesize

                                                    1KB

                                                    MD5

                                                    90c76d97946e50ed9427abe4ea467625

                                                    SHA1

                                                    ecd419f4244f968224766bec66217b1d26245954

                                                    SHA256

                                                    d4f486d7b4b386538c50c0b4ea37734fda54e0deaeb5312928961bd631940d16

                                                    SHA512

                                                    758a4664e972d1f049dbe8ae14b4de5e37bb6ef3fe1d81eb9e79b20d4f338bab2c70a62c3068fea120635d6716ff509711f3c1950fd7afcbdcb4843de7fcd3e7

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

                                                    Filesize

                                                    376KB

                                                    MD5

                                                    97e39a3bde05fdd6bd0194817342e49e

                                                    SHA1

                                                    75f63d9005f5ca6dd2ccbaed4003284b073b9497

                                                    SHA256

                                                    e8a7fb3c47a05f71f63d027f626df3bb597c7dc1bf96ec246ee5847b82b1f1d4

                                                    SHA512

                                                    4e634a745322274a29ed14f7176de1aef6d913b37c9f1ebf71e673c219b9572717d196a3c75bd485d458d8005c4e8d74eb61afe4d4efeed4947fc7073d546055

                                                  • \??\pipe\LOCAL\crashpad_2680_WCLVHQMWRENJUHYY

                                                    MD5

                                                    d41d8cd98f00b204e9800998ecf8427e

                                                    SHA1

                                                    da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                    SHA256

                                                    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                    SHA512

                                                    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                  • memory/1440-31-0x00000000008B0000-0x0000000000D50000-memory.dmp

                                                    Filesize

                                                    4.6MB

                                                  • memory/1440-27-0x00000000008B0000-0x0000000000D50000-memory.dmp

                                                    Filesize

                                                    4.6MB

                                                  • memory/1440-29-0x00000000008B0000-0x0000000000D50000-memory.dmp

                                                    Filesize

                                                    4.6MB

                                                  • memory/1440-28-0x00000000008B0000-0x0000000000D50000-memory.dmp

                                                    Filesize

                                                    4.6MB

                                                  • memory/1460-18-0x00000000008B0000-0x0000000000D50000-memory.dmp

                                                    Filesize

                                                    4.6MB

                                                  • memory/1460-20-0x00000000008B0000-0x0000000000D50000-memory.dmp

                                                    Filesize

                                                    4.6MB

                                                  • memory/1460-56-0x00000000008B0000-0x0000000000D50000-memory.dmp

                                                    Filesize

                                                    4.6MB

                                                  • memory/1460-57-0x00000000008B0000-0x0000000000D50000-memory.dmp

                                                    Filesize

                                                    4.6MB

                                                  • memory/1460-58-0x00000000008B0000-0x0000000000D50000-memory.dmp

                                                    Filesize

                                                    4.6MB

                                                  • memory/1460-59-0x00000000008B0000-0x0000000000D50000-memory.dmp

                                                    Filesize

                                                    4.6MB

                                                  • memory/1460-49-0x00000000008B0000-0x0000000000D50000-memory.dmp

                                                    Filesize

                                                    4.6MB

                                                  • memory/1460-613-0x00000000008B0000-0x0000000000D50000-memory.dmp

                                                    Filesize

                                                    4.6MB

                                                  • memory/1460-50-0x00000000008B0000-0x0000000000D50000-memory.dmp

                                                    Filesize

                                                    4.6MB

                                                  • memory/1460-32-0x00000000008B0000-0x0000000000D50000-memory.dmp

                                                    Filesize

                                                    4.6MB

                                                  • memory/1460-19-0x00000000008B1000-0x00000000008DF000-memory.dmp

                                                    Filesize

                                                    184KB

                                                  • memory/1460-55-0x00000000008B0000-0x0000000000D50000-memory.dmp

                                                    Filesize

                                                    4.6MB

                                                  • memory/1460-34-0x00000000008B0000-0x0000000000D50000-memory.dmp

                                                    Filesize

                                                    4.6MB

                                                  • memory/1460-21-0x00000000008B0000-0x0000000000D50000-memory.dmp

                                                    Filesize

                                                    4.6MB

                                                  • memory/1460-22-0x00000000008B0000-0x0000000000D50000-memory.dmp

                                                    Filesize

                                                    4.6MB

                                                  • memory/1460-23-0x00000000008B0000-0x0000000000D50000-memory.dmp

                                                    Filesize

                                                    4.6MB

                                                  • memory/1460-24-0x00000000008B0000-0x0000000000D50000-memory.dmp

                                                    Filesize

                                                    4.6MB

                                                  • memory/1460-131-0x00000000008B0000-0x0000000000D50000-memory.dmp

                                                    Filesize

                                                    4.6MB

                                                  • memory/1460-33-0x00000000008B0000-0x0000000000D50000-memory.dmp

                                                    Filesize

                                                    4.6MB

                                                  • memory/1460-51-0x00000000008B0000-0x0000000000D50000-memory.dmp

                                                    Filesize

                                                    4.6MB

                                                  • memory/2064-53-0x00000000008B0000-0x0000000000D50000-memory.dmp

                                                    Filesize

                                                    4.6MB

                                                  • memory/2064-54-0x00000000008B0000-0x0000000000D50000-memory.dmp

                                                    Filesize

                                                    4.6MB

                                                  • memory/2744-83-0x0000000005170000-0x0000000005798000-memory.dmp

                                                    Filesize

                                                    6.2MB

                                                  • memory/2744-86-0x00000000057A0000-0x0000000005806000-memory.dmp

                                                    Filesize

                                                    408KB

                                                  • memory/2744-103-0x0000000007770000-0x0000000007D14000-memory.dmp

                                                    Filesize

                                                    5.6MB

                                                  • memory/2744-102-0x00000000063D0000-0x00000000063F2000-memory.dmp

                                                    Filesize

                                                    136KB

                                                  • memory/2744-101-0x00000000063B0000-0x00000000063CA000-memory.dmp

                                                    Filesize

                                                    104KB

                                                  • memory/2744-100-0x0000000007120000-0x00000000071B6000-memory.dmp

                                                    Filesize

                                                    600KB

                                                  • memory/2744-98-0x0000000005E50000-0x0000000005E9C000-memory.dmp

                                                    Filesize

                                                    304KB

                                                  • memory/2744-97-0x0000000005E30000-0x0000000005E4E000-memory.dmp

                                                    Filesize

                                                    120KB

                                                  • memory/2744-96-0x0000000005810000-0x0000000005B64000-memory.dmp

                                                    Filesize

                                                    3.3MB

                                                  • memory/2744-82-0x0000000002500000-0x0000000002536000-memory.dmp

                                                    Filesize

                                                    216KB

                                                  • memory/2744-85-0x0000000005020000-0x0000000005086000-memory.dmp

                                                    Filesize

                                                    408KB

                                                  • memory/2744-84-0x0000000004F80000-0x0000000004FA2000-memory.dmp

                                                    Filesize

                                                    136KB

                                                  • memory/3976-17-0x0000000000E10000-0x00000000012B0000-memory.dmp

                                                    Filesize

                                                    4.6MB

                                                  • memory/3976-0-0x0000000000E10000-0x00000000012B0000-memory.dmp

                                                    Filesize

                                                    4.6MB

                                                  • memory/3976-4-0x0000000000E10000-0x00000000012B0000-memory.dmp

                                                    Filesize

                                                    4.6MB

                                                  • memory/3976-3-0x0000000000E10000-0x00000000012B0000-memory.dmp

                                                    Filesize

                                                    4.6MB

                                                  • memory/3976-2-0x0000000000E11000-0x0000000000E3F000-memory.dmp

                                                    Filesize

                                                    184KB

                                                  • memory/3976-1-0x0000000077084000-0x0000000077086000-memory.dmp

                                                    Filesize

                                                    8KB

                                                  • memory/5436-570-0x00000000008B0000-0x0000000000D50000-memory.dmp

                                                    Filesize

                                                    4.6MB

                                                  • memory/5436-571-0x00000000008B0000-0x0000000000D50000-memory.dmp

                                                    Filesize

                                                    4.6MB